feat: add clusterfuzzlite.yml (CFLite PR + batch fuzzing)

.github/workflows/clusterfuzzlite.yml

@@ -0,0 +1,95 @@
+name: clusterfuzzlite
+
+# Reusable ClusterFuzzLite fuzzing workflow (build_fuzzers + run_fuzzers) with
+# sanitizer matrix, PR (code-change) and batch modes, and optional SARIF output.
+# Distinct from fuzzing.yml (which uses cargo-fuzz/libFuzzer on nightly).
+#
+# Usage (PR fuzzing):
+#   pr-fuzz:
+#     uses: NDDev-it-com/ci-workflows/.github/workflows/clusterfuzzlite.yml@<sha>
+#     with:
+#       mode: code-change
+#       language: rust
+#       fuzz_seconds: 300
+#       sanitizer_matrix: '["address"]'
+#       output_sarif: true
+#
+# Usage (batch/scheduled):
+#   batch-fuzz:
+#     uses: NDDev-it-com/ci-workflows/.github/workflows/clusterfuzzlite.yml@<sha>
+#     with:
+#       mode: batch
+#       language: rust
+#       fuzz_seconds: 1800
+
+on:
+  workflow_call:
+    inputs:
+      runner:
+        description: 'Runner label.'
+        type: string
+        default: 'ubuntu-latest'
+      mode:
+        description: 'CFLite mode: code-change (PR) or batch (scheduled).'
+        type: string
+        default: 'code-change'
+      language:
+        description: 'Fuzzing language (rust, go, python, c, c++, jvm, swift, etc.).'
+        type: string
+        default: 'rust'
+      sanitizer_matrix:
+        description: 'JSON array of sanitizers (address, thread, memory, undefined).'
+        type: string
+        default: '["address"]'
+      fuzz_seconds:
+        description: 'Fuzzing duration in seconds.'
+        type: number
+        default: 300
+      output_sarif:
+        description: 'Output SARIF results for code scanning upload.'
+        type: boolean
+        default: true
+      cflite_action_ref:
+        description: 'SHA-pinned google/clusterfuzzlite/actions reference.'
+        type: string
+        default: '52ecc61cb587ee99c26825a112a21abf19c7448c'  # 2024-09-19
+      timeout_minutes:
+        description: 'Job timeout in minutes.'
+        type: number
+        default: 35
+
+permissions: {}
+
+jobs:
+  fuzz:
+    name: Fuzz (${{ matrix.sanitizer }})
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: ${{ inputs.timeout_minutes }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: ${{ fromJSON(inputs.sanitizer_matrix) }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        with:
+          persist-credentials: false
+
+      - name: Build fuzzers (${{ matrix.sanitizer }})
+        uses: google/clusterfuzzlite/actions/build_fuzzers@${{ inputs.cflite_action_ref }}
+        with:
+          language: ${{ inputs.language }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: ${{ matrix.sanitizer }}
+
+      - name: Run fuzzers (${{ matrix.sanitizer }})
+        uses: google/clusterfuzzlite/actions/run_fuzzers@${{ inputs.cflite_action_ref }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: ${{ inputs.fuzz_seconds }}
+          mode: ${{ inputs.mode }}
+          sanitizer: ${{ matrix.sanitizer }}
+          output-sarif: ${{ inputs.output_sarif }}

CHANGELOG.md

@@ -4,6 +4,10 @@
 
 ### Added
 
+- **`clusterfuzzlite.yml` — ClusterFuzzLite PR (code-change) and batch fuzzing.**
+  Reusable CFLite workflow with sanitizer matrix, configurable mode, fuzz
+  duration, and SARIF output. Distinct from `fuzzing.yml` (cargo-fuzz).
+
 - **`rust-supply-chain.yml` — cargo-deny + cargo-audit + cargo-machete.** Three
   independently-toggleable jobs for Rust supply-chain health: deny
   (bans/licenses/advisories/sources), audit (RustSec vulnerability database),

catalog/capabilities.yml

@@ -1571,3 +1571,26 @@ capabilities:
       - "https://github.com/EmbarkStudios/cargo-deny"
       - "https://github.com/rustsec/rustsec"
       - "https://github.com/bnjbvr/cargo-machete"
+
+  - id: clusterfuzzlite-fuzzing
+    name: ClusterFuzzLite fuzzing (PR code-change + batch)
+    cluster: testing-quality
+    status: ga
+    public_oss: free
+    private_free: free
+    private_paid: available
+    workflow: .github/workflows/clusterfuzzlite.yml
+    example: null
+    required_permissions:
+      - "actions: read"
+      - "contents: read"
+      - "security-events: write"
+    required_settings:
+      - "Fuzz targets in the repository (oss-fuzz compatible)"
+    risks:
+      - "Fuzzing consumes significant CI time; tune fuzz_seconds for PR vs batch"
+      - "SARIF upload requires code scanning enabled (free on public repos)"
+    deprecations: null
+    last_verified: "2026-08-04"
+    sources:
+      - "https://github.com/google/clusterfuzzlite"

catalog/runtime-coverage.yml

@@ -246,3 +246,8 @@ entries:
     evidence: 'New reusable workflow; awaiting first live workflow_call run from a consumer.'
     last_run: null
     waiver: null
+  - workflow: .github/workflows/clusterfuzzlite.yml
+    status: unverified
+    evidence: 'New reusable workflow; awaiting first live workflow_call run from a consumer.'
+    last_run: null
+    waiver: null

docs/generated/capability-matrix.md

@@ -75,6 +75,7 @@
 | OSV-Scanner SCA (`osv-scanner-sca`) | supply-chain | ga | free | free | available | `.github/workflows/osv-scan.yml` | `examples/security/osv-scan.yml` |
 | SBOM generation (`sbom-generation`) | supply-chain | ga | free | free | available | `.github/workflows/release-supply-chain.yml` | `-` |
 | SLSA build provenance (`slsa-build-provenance`) | supply-chain | ga | free | paid | conditional | `.github/workflows/release-supply-chain.yml` | `-` |
+| ClusterFuzzLite fuzzing (PR code-change + batch) (`clusterfuzzlite-fuzzing`) | testing-quality | ga | free | free | available | `.github/workflows/clusterfuzzlite.yml` | `-` |
 
 ---
 Last generated: 2026-07-11

docs/generated/workflow-inventory.md

@@ -7,6 +7,7 @@
 | `.github/workflows/benchmark-compare.yml` | `benchmark-compare` | ga |
 | `.github/workflows/benchmark.yml` | `benchmark` | ga |
 | `.github/workflows/ci.yml` | internal | internal |
+| `.github/workflows/clusterfuzzlite.yml` | `clusterfuzzlite-fuzzing` | ga |
 | `.github/workflows/codeql.yml` | internal | internal |
 | `.github/workflows/container-ci.yml` | `container-scan-trivy` | ga |
 | `.github/workflows/coverage-gate.yml` | `coverage-gate` | ga |